Craft CMS CVE-2025-68455

Requires an authenticated session with administrator privileges on the Craft Control Panel (PR:H) - the vendor GHSA and CVE description both state this is mandatory. The attack targets Fields controller endpoints that accept a fieldLayoutConfig/layoutConfig/config body parameter, into which the attacker injects a Yii Behavior (yii\behaviors\AttributeTypecastBehavior) using the 'as <behavior>' attachment syntax, with a wildcard event binding so any event fired on the Component triggers the attacker-defined callable via reflection. Limiting factors: exploitation is confined to Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16; it cannot be performed by unauthenticated or non-admin users; and the patched versions (5.8.21 / 4.16.17) add Component::cleanseConfig() to strip behavior-attachment keys. Realistic risk is elevated only where CP admin is delegated to lower-trust users or where admin credentials/sessions can be compromised.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6 (High) with full confidentiality, integrity, and availability impact reflecting code execution, but the single most important gating factor is PR:H - the vendor GHSA and CVE description both explicitly state the attacker must already hold administrator access to the Craft Control Panel. This substantially lowers real-world priority: the attacker is already a trusted, fully privileged operator, so exploitation is effectively privilege-to-code-execution for someone who can already alter almost anything in the CMS. EPSS is 1.12% (78th percentile) - moderate relative ranking but low absolute probability. POC/exploit code is publicly available (referenced via the GHSA advisory and the technique is documented, building on CVE-2024-4990/CVE-2024-58136 and a Yii-framework advisory), which raises the likelihood of opportunistic use, but there is no CISA KEV listing and no evidence of active exploitation. No SSVC decision data was provided. Signals are consistent - high technical impact but strongly constrained by the admin prerequisite. Net: this is a patch-in-normal-cycle issue for most operators, escalating in priority only where Control Panel admin accounts are broadly delegated, shared, or reachable by lower-trust users.

An attacker who has obtained (or abused) Craft Control Panel administrator access submits a crafted JSON POST to a Fields controller endpoint, attaching a legitimate but weaponized Yii Behavior (yii\behaviors\AttributeTypecastBehavior) to a Component via the 'as <behavior>' syntax. When an event fires on the tainted Component, the behavior's attacker-defined callable is invoked via reflection, executing arbitrary PHP on the server. Public exploit/technique details exist in the GHSA advisory and the related Yii advisory, so reproduction is straightforward for a privileged attacker.